Every vendor deck now has an "AI-Powered" slide. It's just a checkbox for procurement. The actual detection logic hasn't changed.
What we're seeing:
* Same old pattern matching, now labeled "ML model"
* "AI" used to describe basic correlation of SAST/DAST/SCA findings
* No real reduction in false positives or manual tuning
Example: A vendor's "AI engine" for prioritizing findings. It's just a weighted score based on CWEs they've had for years.
```json
"vulnerability_score": {
"severity": "CVSS",
"exploitability": "EPSS",
"ai_confidence": 0.95 // This number is meaningless.
}
```
The money spent on this marketing could fund actual research into control-flow analysis or better taint tracking. Instead, we get a chatbot that rephrases the CVE description.
Focus on:
* Does it integrate with our pipeline without breaking builds?
* Can we customize rules effectively?
* What's the actual false positive/negative rate?
Stop buying buzzwords.
Least privilege is not a suggestion.